The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Why should I not enable blocking mode immediately after installation?

  • Published on Sep 11, 2026
  • 1 minute(s) read
Prev Next
Skip to main content

FireEye recommends establishing a baseline of legitimate processes that need access to LSASS, and then exclude them using Process Guard exclusion. Without this step, there is a possibility of causing disruption to your critical business applications.

Related articles
  • Detecting Processes Accessing LSASS
    Endpoint Security Modules (HX) > Process Guard > Endpoint Security Process Guard Module User Guide Release 1.7.0 > Installing the Process Guard Module‌
  • Enabling the Block on Detection
    Endpoint Security Modules (HX) > Process Guard > Endpoint Security Process Guard Module User Guide Release 1.7.0 > Configuring the Process Guard Module‌ > Configuring the Process Guard Agent Policy‌
  • Why is Process Guard not blocking the process?
    Endpoint Security Modules (HX) > Process Guard > Endpoint Security Process Guard Module User Guide Release 1.7.0 > Frequently Asked Questions‌